appos 0.3.2-0 → 0.3.4-0

package/dist/exports/cli/api/workflows/extract-blob-metadata.mjs

@@ -1 +1,132 @@
-import{defineWorkflow as e}from"../workflow.mjs";import{join as t}from"node:path";import{ALL_FORMATS as n,BlobSource as r,Input as i}from"mediabunny";import a from"zod";const o=e({input:a.object({blobId:a.string()}),async run({container:e,input:{blobId:a},step:o}){let s=await o(`fetch-blob`,async()=>e.storage.primary.getBlob(a));if(!s)throw Error(`Blob ${a} not found`);let c=await o(`download-blob`,async()=>e.storage.primary.downloadBlob(a));if(!c)throw Error(`Failed to download blob ${a}`);let l={};return s.contentType?.startsWith(`image/`)?l=await o(`extract-image-metadata`,async()=>{let e=(await import(`sharp`)).default,t=await e(c).metadata();return{width:t.width,height:t.height,format:t.format,hasAlpha:t.hasAlpha,space:t.space}}):s.contentType?.startsWith(`video/`)||s.contentType?.startsWith(`audio/`)?l=await o(`extract-media-metadata`,async()=>{let e=new Uint8Array(c),t=new i({source:new r(new Blob([e],{type:s.contentType||`video/mp4`})),formats:n}),a=await t.computeDuration(),o=await t.getMetadataTags(),l={},u={},d=!1,f=!1;try{let e=await t.getPrimaryVideoTrack();if(e){d=!0;let t=e.displayWidth&&e.displayHeight?e.displayWidth/e.displayHeight:null;l={width:e.displayWidth,height:e.displayHeight,rotation:e.rotation,angle:e.rotation,displayAspectRatio:t}}}catch{}try{let e=await t.getPrimaryAudioTrack();e&&(f=!0,u={sampleRate:e.sampleRate,channels:e.numberOfChannels})}catch{}return{duration:a,video:d,audio:f,...l,...u,tags:o}}):s.contentType===`application/pdf`&&(l=await o(`extract-pdf-metadata`,async()=>{try{let e=await import(`pdfjs-dist/legacy/build/pdf.mjs`),n=`${t(process.cwd(),`node_modules/pdfjs-dist/standard_fonts`)}/`,r=await e.getDocument({data:new Uint8Array(c),standardFontDataUrl:n}).promise,i=await r.getMetadata(),a=(await r.getPage(1)).getViewport({scale:1}),o=i.info;return{pageCount:r.numPages,width:a.width,height:a.height,title:o?.Title||null,author:o?.Author||null,subject:o?.Subject||null,keywords:o?.Keywords||null,creator:o?.Creator||null,producer:o?.Producer||null,creationDate:o?.CreationDate||null,modificationDate:o?.ModDate||null,pdfVersion:o?.PDFFormatVersion||null}}catch(t){return e.logger.error({error:t,errorMessage:t instanceof Error?t.message:String(t),errorStack:t instanceof Error?t.stack:void 0,errorCode:t?.code,blobId:a},`Failed to extract PDF metadata`),{error:`Failed to extract PDF metadata`,errorMessage:t instanceof Error?t.message:String(t)}}})),await o(`save-metadata`,async()=>{await e.storage.primary.updateBlobMetadata(a,{...l,analyzed:!0})}),e.logger.info({blobId:a,metadata:l},`Metadata extracted`),{...l,analyzed:!0}}});export{o as extractBlobMetadata};
+import { defineWorkflow } from "../workflow.mjs";
+import { join } from "node:path";
+import { ALL_FORMATS, BlobSource, Input } from "mediabunny";
+import z$1 from "zod";
+
+//#region src/api/workflows/extract-blob-metadata.ts
+const extractBlobMetadata = defineWorkflow({
+	input: z$1.object({ blobId: z$1.string() }),
+	async run({ container, input: { blobId }, step }) {
+		const blob = await step("fetch-blob", async () => {
+			return container.storage.primary.getBlob(blobId);
+		});
+		if (!blob) throw new Error(`Blob ${blobId} not found`);
+		const buffer = await step("download-blob", async () => {
+			return container.storage.primary.downloadBlob(blobId);
+		});
+		if (!buffer) throw new Error(`Failed to download blob ${blobId}`);
+		let metadata = {};
+		if (blob.contentType?.startsWith("image/")) metadata = await step("extract-image-metadata", async () => {
+			const sharp = (await import("sharp")).default;
+			const info = await sharp(buffer).metadata();
+			return {
+				width: info.width,
+				height: info.height,
+				format: info.format,
+				hasAlpha: info.hasAlpha,
+				space: info.space
+			};
+		});
+		else if (blob.contentType?.startsWith("video/") || blob.contentType?.startsWith("audio/")) metadata = await step("extract-media-metadata", async () => {
+			const uint8Array = new Uint8Array(buffer);
+			const input = new Input({
+				source: new BlobSource(new Blob([uint8Array], { type: blob.contentType || "video/mp4" })),
+				formats: ALL_FORMATS
+			});
+			const duration = await input.computeDuration();
+			const tags = await input.getMetadataTags();
+			let videoData = {};
+			let audioData = {};
+			let hasVideo = false;
+			let hasAudio = false;
+			try {
+				const videoTrack = await input.getPrimaryVideoTrack();
+				if (videoTrack) {
+					hasVideo = true;
+					const displayAspectRatio = videoTrack.displayWidth && videoTrack.displayHeight ? videoTrack.displayWidth / videoTrack.displayHeight : null;
+					videoData = {
+						width: videoTrack.displayWidth,
+						height: videoTrack.displayHeight,
+						rotation: videoTrack.rotation,
+						angle: videoTrack.rotation,
+						displayAspectRatio
+					};
+				}
+			} catch {}
+			try {
+				const audioTrack = await input.getPrimaryAudioTrack();
+				if (audioTrack) {
+					hasAudio = true;
+					audioData = {
+						sampleRate: audioTrack.sampleRate,
+						channels: audioTrack.numberOfChannels
+					};
+				}
+			} catch {}
+			return {
+				duration,
+				video: hasVideo,
+				audio: hasAudio,
+				...videoData,
+				...audioData,
+				tags
+			};
+		});
+		else if (blob.contentType === "application/pdf") metadata = await step("extract-pdf-metadata", async () => {
+			try {
+				const pdfjsLib = await import("pdfjs-dist/legacy/build/pdf.mjs");
+				const standardFontDataUrl = `${join(process.cwd(), "node_modules/pdfjs-dist/standard_fonts")}/`;
+				const pdf = await pdfjsLib.getDocument({
+					data: new Uint8Array(buffer),
+					standardFontDataUrl
+				}).promise;
+				const pdfMetadata = await pdf.getMetadata();
+				const viewport = (await pdf.getPage(1)).getViewport({ scale: 1 });
+				const info = pdfMetadata.info;
+				return {
+					pageCount: pdf.numPages,
+					width: viewport.width,
+					height: viewport.height,
+					title: info?.Title || null,
+					author: info?.Author || null,
+					subject: info?.Subject || null,
+					keywords: info?.Keywords || null,
+					creator: info?.Creator || null,
+					producer: info?.Producer || null,
+					creationDate: info?.CreationDate || null,
+					modificationDate: info?.ModDate || null,
+					pdfVersion: info?.PDFFormatVersion || null
+				};
+			} catch (error) {
+				container.logger.error({
+					error,
+					errorMessage: error instanceof Error ? error.message : String(error),
+					errorStack: error instanceof Error ? error.stack : void 0,
+					errorCode: error?.code,
+					blobId
+				}, "Failed to extract PDF metadata");
+				return {
+					error: "Failed to extract PDF metadata",
+					errorMessage: error instanceof Error ? error.message : String(error)
+				};
+			}
+		});
+		await step("save-metadata", async () => {
+			await container.storage.primary.updateBlobMetadata(blobId, {
+				...metadata,
+				analyzed: true
+			});
+		});
+		container.logger.info({
+			blobId,
+			metadata
+		}, "Metadata extracted");
+		return {
+			...metadata,
+			analyzed: true
+		};
+	}
+});
+
+//#endregion
+export { extractBlobMetadata };

package/dist/exports/cli/api/workflows/generate-image-variant.mjs

@@ -1 +1,118 @@
-import{defineWorkflow as e}from"../workflow.mjs";import{z as t}from"zod";const n=t.object({width:t.number().optional(),height:t.number().optional(),fit:t.enum([`cover`,`contain`,`fill`,`inside`,`outside`]).optional(),position:t.enum([`top`,`right top`,`right`,`right bottom`,`bottom`,`left bottom`,`left`,`left top`,`centre`]).optional(),kernel:t.enum([`nearest`,`linear`,`cubic`,`mitchell`,`lanczos2`,`lanczos3`]).optional()}),r=t.object({resize:n.optional(),rotate:t.number().optional(),flip:t.boolean().optional(),flop:t.boolean().optional(),sharpen:t.boolean().optional(),blur:t.number().optional(),grayscale:t.boolean().optional(),format:t.enum([`jpeg`,`png`,`webp`,`avif`,`gif`]).optional(),quality:t.number().min(1).max(100).optional(),preview:t.literal(!0).optional()}),i=e({input:t.object({blobId:t.string(),transformations:r}),async run({container:e,input:{blobId:t,transformations:n},step:r}){if(!await r(`fetch-blob`,async()=>e.storage.primary.getBlob(t)))throw Error(`Blob ${t} not found`);let i=await r(`download-blob`,async()=>e.storage.primary.downloadBlob(t));if(!i)throw Error(`Failed to download blob ${t}`);let a=await r(`apply-transformations`,async()=>{let e=(await import(`sharp`)).default,t=e(i);return n.resize&&(t=t.resize({width:n.resize.width,height:n.resize.height,fit:n.resize.fit,position:n.resize.position,kernel:n.resize.kernel})),n.rotate!==void 0&&(t=t.rotate(n.rotate)),n.flip&&(t=t.flip()),n.flop&&(t=t.flop()),n.sharpen&&(t=t.sharpen()),n.blur!==void 0&&(t=t.blur(n.blur)),n.grayscale&&(t=t.grayscale()),n.format&&(t=t.toFormat(n.format,{quality:n.quality})),t.toBuffer()}),o=await r(`store-variant`,async()=>e.storage.primary.createVariant(t,n,a));return e.logger.info({blobId:t,variantId:o.id},`Image variant generated`),o}});export{i as generateImageVariant};
+import { defineWorkflow } from "../workflow.mjs";
+import { z } from "zod";
+
+//#region src/api/workflows/generate-image-variant.ts
+/**
+* Resize options schema for image transformations.
+*/
+const resizeSchema = z.object({
+	width: z.number().optional(),
+	height: z.number().optional(),
+	fit: z.enum([
+		"cover",
+		"contain",
+		"fill",
+		"inside",
+		"outside"
+	]).optional(),
+	position: z.enum([
+		"top",
+		"right top",
+		"right",
+		"right bottom",
+		"bottom",
+		"left bottom",
+		"left",
+		"left top",
+		"centre"
+	]).optional(),
+	kernel: z.enum([
+		"nearest",
+		"linear",
+		"cubic",
+		"mitchell",
+		"lanczos2",
+		"lanczos3"
+	]).optional()
+});
+/**
+* Image transformations schema.
+* Supports resize, rotate, flip, flop, sharpen, blur, grayscale, format conversion.
+*/
+const transformationsSchema = z.object({
+	resize: resizeSchema.optional(),
+	rotate: z.number().optional(),
+	flip: z.boolean().optional(),
+	flop: z.boolean().optional(),
+	sharpen: z.boolean().optional(),
+	blur: z.number().optional(),
+	grayscale: z.boolean().optional(),
+	format: z.enum([
+		"jpeg",
+		"png",
+		"webp",
+		"avif",
+		"gif"
+	]).optional(),
+	quality: z.number().min(1).max(100).optional(),
+	preview: z.literal(true).optional()
+});
+/**
+* Generate image variant workflow. Applies transformations to create variants.
+*
+* Algorithm:
+* 1. Fetch blob by ID
+* 2. Download blob content
+* 3. Apply transformations using Sharp:
+*    - Resize with various fit options
+*    - Rotate by degrees
+*    - Flip/flop (vertical/horizontal mirror)
+*    - Sharpen, blur, grayscale filters
+*    - Format conversion with quality settings
+* 4. Store variant with transformation metadata
+*/
+const generateImageVariant = defineWorkflow({
+	input: z.object({
+		blobId: z.string(),
+		transformations: transformationsSchema
+	}),
+	async run({ container, input: { blobId, transformations }, step }) {
+		if (!await step("fetch-blob", async () => {
+			return container.storage.primary.getBlob(blobId);
+		})) throw new Error(`Blob ${blobId} not found`);
+		const buffer = await step("download-blob", async () => {
+			return container.storage.primary.downloadBlob(blobId);
+		});
+		if (!buffer) throw new Error(`Failed to download blob ${blobId}`);
+		const variantBuffer = await step("apply-transformations", async () => {
+			const sharp = (await import("sharp")).default;
+			let pipeline = sharp(buffer);
+			if (transformations.resize) pipeline = pipeline.resize({
+				width: transformations.resize.width,
+				height: transformations.resize.height,
+				fit: transformations.resize.fit,
+				position: transformations.resize.position,
+				kernel: transformations.resize.kernel
+			});
+			if (transformations.rotate !== void 0) pipeline = pipeline.rotate(transformations.rotate);
+			if (transformations.flip) pipeline = pipeline.flip();
+			if (transformations.flop) pipeline = pipeline.flop();
+			if (transformations.sharpen) pipeline = pipeline.sharpen();
+			if (transformations.blur !== void 0) pipeline = pipeline.blur(transformations.blur);
+			if (transformations.grayscale) pipeline = pipeline.grayscale();
+			if (transformations.format) pipeline = pipeline.toFormat(transformations.format, { quality: transformations.quality });
+			return pipeline.toBuffer();
+		});
+		const variant = await step("store-variant", async () => {
+			return container.storage.primary.createVariant(blobId, transformations, variantBuffer);
+		});
+		container.logger.info({
+			blobId,
+			variantId: variant.id
+		}, "Image variant generated");
+		return variant;
+	}
+});
+
+//#endregion
+export { generateImageVariant };

package/dist/exports/cli/api/workflows/generate-preview.mjs

@@ -1 +1,160 @@
-import{defineWorkflow as e}from"../workflow.mjs";import{join as t}from"node:path";import n from"zod";import{spawn as r}from"node:child_process";const i=e({input:n.object({blobId:n.string(),timeInSeconds:n.number().optional()}),async run({container:e,input:{blobId:n,timeInSeconds:i=1},step:a}){let o=await a(`fetch-blob`,async()=>e.storage.primary.getBlob(n));if(!o)throw Error(`Blob ${n} not found`);let s=await a(`download-blob`,async()=>e.storage.primary.downloadBlob(n));if(!s)throw Error(`Failed to download blob ${n}`);let c=null;if(o.contentType?.startsWith(`video/`))c=await a(`generate-video-preview`,async()=>new Promise((t,a)=>{try{let o=r(`ffmpeg`,[`-i`,`pipe:0`,`-ss`,i.toString(),`-frames:v`,`1`,`-f`,`image2pipe`,`-c:v`,`png`,`pipe:1`]),c=[],l=[];o.stdout.on(`data`,e=>{c.push(e)}),o.stderr.on(`data`,e=>{l.push(e)}),o.on(`close`,async r=>{if(r===0)try{let e=Buffer.concat(c),n=(await import(`sharp`)).default;t(await n(e).jpeg({quality:80}).toBuffer())}catch(t){e.logger.error({error:t,blobId:n},`Failed to convert video frame to JPEG`),a(t)}else{let t=Buffer.concat(l).toString(),i=Error(`FFmpeg exited with code ${r}: ${t}`);e.logger.error({error:i,blobId:n,code:r,stderr:t},`Failed to generate video preview`),a(i)}}),o.on(`error`,t=>{e.logger.error({error:t,blobId:n},`Failed to spawn FFmpeg process`),a(t)}),o.stdin.on(`error`,t=>{t.code!==`EPIPE`&&e.logger.error({error:t,blobId:n},`Failed to write to FFmpeg stdin`)}),o.stdin.write(s),o.stdin.end()}catch(t){e.logger.error({error:t,blobId:n},`Failed to generate video preview`),a(t)}}));else if(o.contentType===`application/pdf`)c=await a(`generate-pdf-preview`,async()=>{try{let e=await import(`pdfjs-dist/legacy/build/pdf.mjs`),{createCanvas:n}=await import(`canvas`),r=(await import(`sharp`)).default,i=`${t(process.cwd(),`node_modules/pdfjs-dist/standard_fonts`)}/`,a=await(await e.getDocument({data:new Uint8Array(s),standardFontDataUrl:i}).promise).getPage(1),o=a.getViewport({scale:2}),c=n(o.width,o.height),l=c.getContext(`2d`);return await a.render({canvasContext:l,viewport:o,canvas:c}).promise,await r(c.toBuffer(`image/png`)).resize(800,800,{fit:`inside`,withoutEnlargement:!0}).jpeg({quality:85}).toBuffer()}catch(t){throw e.logger.error({error:t,errorMessage:t instanceof Error?t.message:String(t),errorStack:t instanceof Error?t.stack:void 0,errorCode:t?.code,blobId:n},`Failed to generate PDF preview`),t}});else if(o.contentType?.startsWith(`image/`))c=await a(`generate-image-preview`,async()=>{let e=(await import(`sharp`)).default;return await e(s).resize(800,800,{fit:`inside`,withoutEnlargement:!0}).jpeg({quality:85}).toBuffer()});else throw Error(`Preview generation not supported for content type: ${o.contentType}`);let l=await a(`store-preview`,async()=>await e.storage.primary.createVariant(n,{preview:!0},c));return e.logger.info({blobId:n,previewId:l.id,contentType:o.contentType},`Preview generated`),l}});export{i as generatePreview};
+import { defineWorkflow } from "../workflow.mjs";
+import { join } from "node:path";
+import z$1 from "zod";
+import { spawn } from "node:child_process";
+
+//#region src/api/workflows/generate-preview.ts
+/**
+* Generate preview workflow. Creates preview images/thumbnails for PDFs and videos.
+*
+* Algorithm:
+* 1. Fetch blob by ID
+* 2. Download blob content
+* 3. Generate preview based on content type:
+*    - Video: Extract frame at specified time using FFmpeg
+*    - PDF: Render first page using pdfjs-dist + canvas
+*    - Image: Resize to max 800x800 maintaining aspect ratio
+* 4. Store preview as a special variant with "preview" transformation key
+*/
+const generatePreview = defineWorkflow({
+	input: z$1.object({
+		blobId: z$1.string(),
+		timeInSeconds: z$1.number().optional()
+	}),
+	async run({ container, input: { blobId, timeInSeconds = 1 }, step }) {
+		const blob = await step("fetch-blob", async () => {
+			return container.storage.primary.getBlob(blobId);
+		});
+		if (!blob) throw new Error(`Blob ${blobId} not found`);
+		const buffer = await step("download-blob", async () => {
+			return container.storage.primary.downloadBlob(blobId);
+		});
+		if (!buffer) throw new Error(`Failed to download blob ${blobId}`);
+		let previewBuffer = null;
+		if (blob.contentType?.startsWith("video/")) previewBuffer = await step("generate-video-preview", async () => {
+			return new Promise((resolve, reject) => {
+				try {
+					const ffmpeg = spawn("ffmpeg", [
+						"-i",
+						"pipe:0",
+						"-ss",
+						timeInSeconds.toString(),
+						"-frames:v",
+						"1",
+						"-f",
+						"image2pipe",
+						"-c:v",
+						"png",
+						"pipe:1"
+					]);
+					const chunks = [];
+					const errorChunks = [];
+					ffmpeg.stdout.on("data", (chunk) => {
+						chunks.push(chunk);
+					});
+					ffmpeg.stderr.on("data", (chunk) => {
+						errorChunks.push(chunk);
+					});
+					ffmpeg.on("close", async (code) => {
+						if (code === 0) try {
+							const pngBuffer = Buffer.concat(chunks);
+							const sharp = (await import("sharp")).default;
+							resolve(await sharp(pngBuffer).jpeg({ quality: 80 }).toBuffer());
+						} catch (error) {
+							container.logger.error({
+								error,
+								blobId
+							}, "Failed to convert video frame to JPEG");
+							reject(error);
+						}
+						else {
+							const errorMessage = Buffer.concat(errorChunks).toString();
+							const error = /* @__PURE__ */ new Error(`FFmpeg exited with code ${code}: ${errorMessage}`);
+							container.logger.error({
+								error,
+								blobId,
+								code,
+								stderr: errorMessage
+							}, "Failed to generate video preview");
+							reject(error);
+						}
+					});
+					ffmpeg.on("error", (error) => {
+						container.logger.error({
+							error,
+							blobId
+						}, "Failed to spawn FFmpeg process");
+						reject(error);
+					});
+					ffmpeg.stdin.on("error", (error) => {
+						if (error.code !== "EPIPE") container.logger.error({
+							error,
+							blobId
+						}, "Failed to write to FFmpeg stdin");
+					});
+					ffmpeg.stdin.write(buffer);
+					ffmpeg.stdin.end();
+				} catch (error) {
+					container.logger.error({
+						error,
+						blobId
+					}, "Failed to generate video preview");
+					reject(error);
+				}
+			});
+		});
+		else if (blob.contentType === "application/pdf") previewBuffer = await step("generate-pdf-preview", async () => {
+			try {
+				const pdfjsLib = await import("pdfjs-dist/legacy/build/pdf.mjs");
+				const { createCanvas } = await import("canvas");
+				const sharp = (await import("sharp")).default;
+				const standardFontDataUrl = `${join(process.cwd(), "node_modules/pdfjs-dist/standard_fonts")}/`;
+				const page = await (await pdfjsLib.getDocument({
+					data: new Uint8Array(buffer),
+					standardFontDataUrl
+				}).promise).getPage(1);
+				const viewport = page.getViewport({ scale: 2 });
+				const canvas = createCanvas(viewport.width, viewport.height);
+				const context = canvas.getContext("2d");
+				await page.render({
+					canvasContext: context,
+					viewport,
+					canvas
+				}).promise;
+				return await sharp(canvas.toBuffer("image/png")).resize(800, 800, {
+					fit: "inside",
+					withoutEnlargement: true
+				}).jpeg({ quality: 85 }).toBuffer();
+			} catch (error) {
+				container.logger.error({
+					error,
+					errorMessage: error instanceof Error ? error.message : String(error),
+					errorStack: error instanceof Error ? error.stack : void 0,
+					errorCode: error?.code,
+					blobId
+				}, "Failed to generate PDF preview");
+				throw error;
+			}
+		});
+		else if (blob.contentType?.startsWith("image/")) previewBuffer = await step("generate-image-preview", async () => {
+			const sharp = (await import("sharp")).default;
+			return await sharp(buffer).resize(800, 800, {
+				fit: "inside",
+				withoutEnlargement: true
+			}).jpeg({ quality: 85 }).toBuffer();
+		});
+		else throw new Error(`Preview generation not supported for content type: ${blob.contentType}`);
+		const preview = await step("store-preview", async () => {
+			return await container.storage.primary.createVariant(blobId, { preview: true }, previewBuffer);
+		});
+		container.logger.info({
+			blobId,
+			previewId: preview.id,
+			contentType: blob.contentType
+		}, "Preview generated");
+		return preview;
+	}
+});
+
+//#endregion
+export { generatePreview };

package/dist/exports/cli/api/workflows/purge-attachment.mjs

@@ -1 +1,34 @@
-import{defineWorkflow as e}from"../workflow.mjs";import t from"zod";const n=e({input:t.object({attachmentIds:t.array(t.string()).min(1)}),async run({container:e,input:{attachmentIds:t},step:n}){let r=await n(`fetch-attachments`,async()=>(await e.storage.primary.getAttachmentsByIds(t)).filter(e=>e.blob!==null).map(e=>({attachmentId:e.id,blobId:e.blob.id})));return await n(`delete-attachments`,async()=>{for(let{attachmentId:t}of r)await e.storage.primary.deleteAttachment(t)}),await n(`delete-blobs`,async()=>{for(let{blobId:t}of r)await e.storage.primary.deleteBlob(t)}),e.logger.info({attachmentIds:t,blobCount:r.length},`Attachments and blobs purged`),{purgedCount:r.length}}});export{n as purgeAttachment};
+import { defineWorkflow } from "../workflow.mjs";
+import z$1 from "zod";
+
+//#region src/api/workflows/purge-attachment.ts
+/**
+* Purge attachment workflow. Deletes attachments and their associated blobs
+* in the background. This workflow is enqueued by `.purge_later()` calls on
+* attachment objects.
+*/
+const purgeAttachment = defineWorkflow({
+	input: z$1.object({ attachmentIds: z$1.array(z$1.string()).min(1) }),
+	async run({ container, input: { attachmentIds }, step }) {
+		const attachments = await step("fetch-attachments", async () => {
+			return (await container.storage.primary.getAttachmentsByIds(attachmentIds)).filter((r) => r.blob !== null).map((r) => ({
+				attachmentId: r.id,
+				blobId: r.blob.id
+			}));
+		});
+		await step("delete-attachments", async () => {
+			for (const { attachmentId } of attachments) await container.storage.primary.deleteAttachment(attachmentId);
+		});
+		await step("delete-blobs", async () => {
+			for (const { blobId } of attachments) await container.storage.primary.deleteBlob(blobId);
+		});
+		container.logger.info({
+			attachmentIds,
+			blobCount: attachments.length
+		}, "Attachments and blobs purged");
+		return { purgedCount: attachments.length };
+	}
+});
+
+//#endregion
+export { purgeAttachment };

package/dist/exports/cli/api/workflows/purge-audit-logs.mjs

@@ -1 +1,47 @@
-import{defineScheduledWorkflow as e}from"../workflow.mjs";import{defineAuthSchema as t}from"../auth-schema.mjs";import{lt as n}from"drizzle-orm";const r=t();function i(t=`0 0 * * *`){return e({crontab:t,async run({container:e,step:t,scheduledTime:i}){let a=e.auth.auditLog?.retentionDays??90,o=new Date(i);o.setDate(o.getDate()-a);let s=o.toISOString(),c=await t(`delete-old-logs`,async()=>{let{auditLogs:t}=r.tables;return(await e.db.primary.delete(t).where(n(t.createdAt,s)).returning({id:t.id})).length});e.logger.info({deletedCount:c,retentionDays:a,cutoffDate:s},`Audit log purge completed`)}})}export{i as definePurgeAuditLogs};
+import { defineScheduledWorkflow } from "../workflow.mjs";
+import { defineAuthSchema } from "../auth-schema.mjs";
+import { lt } from "drizzle-orm";
+
+//#region src/api/workflows/purge-audit-logs.ts
+const authSchema = defineAuthSchema();
+/**
+* Default cron: midnight daily
+*/
+const DEFAULT_CRON = "0 0 * * *";
+/**
+* Default retention period: 90 days
+*/
+const DEFAULT_RETENTION_DAYS = 90;
+/**
+* Defines purge audit logs workflow with configurable cron schedule.
+*
+* Algorithm:
+* 1. Calculate cutoff date from scheduledTime minus retentionDays
+* 2. Delete all audit logs with createdAt before cutoff
+* 3. Log the number of deleted records
+*
+* @param crontab - Cron expression from auth.auditLog.purgeCron.
+*/
+function definePurgeAuditLogs(crontab = DEFAULT_CRON) {
+	return defineScheduledWorkflow({
+		crontab,
+		async run({ container, step, scheduledTime }) {
+			const retentionDays = container.auth.auditLog?.retentionDays ?? DEFAULT_RETENTION_DAYS;
+			const cutoffDate = new Date(scheduledTime);
+			cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+			const cutoffISO = cutoffDate.toISOString();
+			const deletedCount = await step("delete-old-logs", async () => {
+				const { auditLogs } = authSchema.tables;
+				return (await container.db.primary.delete(auditLogs).where(lt(auditLogs.createdAt, cutoffISO)).returning({ id: auditLogs.id })).length;
+			});
+			container.logger.info({
+				deletedCount,
+				retentionDays,
+				cutoffDate: cutoffISO
+			}, "Audit log purge completed");
+		}
+	});
+}
+
+//#endregion
+export { definePurgeAuditLogs };

package/dist/exports/cli/api/workflows/purge-unattached-blobs.mjs

@@ -1 +1,46 @@
-import{defineScheduledWorkflow as e}from"../workflow.mjs";function t(t=`0 0 * * *`){return e({crontab:t,async run({container:e,step:t}){let n=new Date(Date.now()-2880*60*1e3).toISOString(),r=await t(`fetch-unattached-blobs`,async()=>e.storage.primary.getUnattachedBlobs({olderThan:n})),i=await t(`fetch-pending-blobs`,async()=>e.storage.primary.getPendingBlobs(n)),a=[...r,...i],o=0;for(let n of a)await t(`delete-blob`,async()=>{await e.storage.primary.deleteBlob(n.id),o++});e.logger.info({purgedCount:o,unattachedCount:r.length,pendingCount:i.length},`Orphaned blobs purged`)}})}export{t as definePurgeUnattachedBlobs};
+import { defineScheduledWorkflow } from "../workflow.mjs";
+
+//#region src/api/workflows/purge-unattached-blobs.ts
+/**
+* Default cron: midnight daily
+*/
+const DEFAULT_CRON = "0 0 * * *";
+/**
+* Defines purge unattached blobs workflow with configurable cron schedule.
+*
+* Algorithm:
+* 1. Fetch unattached blobs older than 48 hours
+* 2. Fetch pending blobs (stuck direct uploads) older than 48 hours
+* 3. Delete each orphaned blob from storage and database
+* 4. Log the purge summary
+*
+* @param crontab - Cron expression for when to run (default: daily at midnight)
+*/
+function definePurgeUnattachedBlobs(crontab = DEFAULT_CRON) {
+	return defineScheduledWorkflow({
+		crontab,
+		async run({ container, step }) {
+			const olderThan = (/* @__PURE__ */ new Date(Date.now() - 2880 * 60 * 1e3)).toISOString();
+			const unattachedBlobs = await step("fetch-unattached-blobs", async () => {
+				return container.storage.primary.getUnattachedBlobs({ olderThan });
+			});
+			const pendingBlobs = await step("fetch-pending-blobs", async () => {
+				return container.storage.primary.getPendingBlobs(olderThan);
+			});
+			const allOrphans = [...unattachedBlobs, ...pendingBlobs];
+			let purgedCount = 0;
+			for (const blob of allOrphans) await step("delete-blob", async () => {
+				await container.storage.primary.deleteBlob(blob.id);
+				purgedCount++;
+			});
+			container.logger.info({
+				purgedCount,
+				unattachedCount: unattachedBlobs.length,
+				pendingCount: pendingBlobs.length
+			}, "Orphaned blobs purged");
+		}
+	});
+}
+
+//#endregion
+export { definePurgeUnattachedBlobs };

package/dist/exports/cli/api/workflows/track-db-changes.mjs

@@ -1 +1,110 @@
-import{defineWorkflow as e}from"../workflow.mjs";import{defineAuthSchema as t}from"../auth-schema.mjs";import{dbChangesEvent as n}from"../event.mjs";import{z as r}from"zod";const i=t(),a=r.object({changes:r.array(r.object({_table:r.string(),old:r.record(r.string(),r.unknown()).nullable(),new:r.record(r.string(),r.unknown()).nullable()})),dbName:r.string(),organizationId:r.string().nullable(),requestId:r.string(),sessionId:r.string().nullable(),userId:r.string().nullable()});function o(e){return e.old===null?`INSERT`:e.new===null?`DELETE`:`UPDATE`}const s=e({input:a,async run({container:e,step:t,input:r}){let{dbName:a,changes:s,organizationId:c,userId:l,sessionId:u,requestId:d}=r;if(s.length===0)return{processed:0,audited:0,published:0};let f=new Date().toISOString(),p=0,m=0;for(let r of s){let s=r._table,h=o(r),g=`${a}.${s}`;e.auth.shouldAudit(g)&&(await t(`audit:${g}`,async()=>{await e.db.primary.insert(i.tables.auditLogs).values({tableName:g,action:h,oldData:r.old,newData:r.new,organizationId:c,userId:l,sessionId:u,requestId:d,createdAt:f})}),p++),await t(`event:${g}`,async()=>{await n.emit({action:h,oldData:r.old,newData:r.new,organizationId:c,tableName:g,timestamp:f,userId:l})}),m++}return{processed:s.length,audited:p,published:m}}});export{s as trackDbChanges};
+import { defineWorkflow } from "../workflow.mjs";
+import { defineAuthSchema } from "../auth-schema.mjs";
+import { dbChangesEvent } from "../event.mjs";
+import { z } from "zod";
+
+//#region src/api/workflows/track-db-changes.ts
+const authSchema = defineAuthSchema();
+/**
+* Input schema for trackDbChanges workflow.
+* Accepts dbChanges() output directly from .returning() clause.
+*/
+const trackDbChangesInputSchema = z.object({
+	changes: z.array(z.object({
+		_table: z.string(),
+		old: z.record(z.string(), z.unknown()).nullable(),
+		new: z.record(z.string(), z.unknown()).nullable()
+	})),
+	dbName: z.string(),
+	organizationId: z.string().nullable(),
+	requestId: z.string(),
+	sessionId: z.string().nullable(),
+	userId: z.string().nullable()
+});
+/**
+* Infers action type from change record based on old/new nullness.
+* Uses uppercase SQL-style actions to match OCSF/CADF standards.
+*
+* Algorithm:
+* - old is null → INSERT (new row created)
+* - new is null → DELETE (row removed)
+* - both present → UPDATE (row modified)
+*
+* @param change - Change record with old and new values
+* @returns Action type: "INSERT" if old is null, "DELETE" if new is null, otherwise "UPDATE"
+*/
+function inferAction(change) {
+	if (change.old === null) return "INSERT";
+	if (change.new === null) return "DELETE";
+	return "UPDATE";
+}
+/**
+* Built-in workflow for processing database changes.
+* Handles audit logging and pub/sub notifications with type-safe table filtering.
+*
+* Algorithm:
+* 1. For each change in input, infer the action (INSERT/UPDATE/DELETE)
+* 2. If table is not excluded from audit logging:
+*    - Insert into audit_logs table with full context
+* 3. Emit to dbChangesEvent (publishes via Redis if subscribed handlers exist)
+*
+* Filtering is configured via:
+* - `container.auth.shouldAudit()` - Check if table should be audited
+*
+* @returns Object with counts: processed (total changes), audited (logged to audit_logs), published (emitted to event)
+*/
+const trackDbChanges = defineWorkflow({
+	input: trackDbChangesInputSchema,
+	async run({ container, step, input }) {
+		const { dbName, changes, organizationId, userId, sessionId, requestId } = input;
+		if (changes.length === 0) return {
+			processed: 0,
+			audited: 0,
+			published: 0
+		};
+		const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+		let audited = 0;
+		let published = 0;
+		for (const change of changes) {
+			const tableName = change._table;
+			const action = inferAction(change);
+			const qualifiedTable = `${dbName}.${tableName}`;
+			if (container.auth.shouldAudit(qualifiedTable)) {
+				await step(`audit:${qualifiedTable}`, async () => {
+					await container.db.primary.insert(authSchema.tables.auditLogs).values({
+						tableName: qualifiedTable,
+						action,
+						oldData: change.old,
+						newData: change.new,
+						organizationId,
+						userId,
+						sessionId,
+						requestId,
+						createdAt: timestamp
+					});
+				});
+				audited++;
+			}
+			await step(`event:${qualifiedTable}`, async () => {
+				await dbChangesEvent.emit({
+					action,
+					oldData: change.old,
+					newData: change.new,
+					organizationId,
+					tableName: qualifiedTable,
+					timestamp,
+					userId
+				});
+			});
+			published++;
+		}
+		return {
+			processed: changes.length,
+			audited,
+			published
+		};
+	}
+});
+
+//#endregion
+export { trackDbChanges };